What is the CVSS score of CVE-2026-55689?

CVE-2026-55689 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of OpenFGA are affected by CVE-2026-55689?

OpenFGA authorization management software (versions 1.17.1 and earlier) has a configuration flaw that allows internal users and services to bypass authorization controls and access sensitive…. A patch is available.

How to fix or mitigate CVE-2026-55689?

Within 24 hours, identify all OpenFGA instances running version 1.17.1 or earlier using OIDC authentication without an explicit audience value configured-these deployments accept tokens from any service using the same identity provider. Within 7 days, upgrade OpenFGA to the patched version per vendor advisory and configure the audience validation setting with the appropriate audience claim. Within 30 days, review OpenFGA access logs and JWT token events during the exposure window to confirm no unauthorized tokens accessed authorization data.

OpenFGA CVE-2026-55689

HIGH

Improper Authentication (CWE-287)

2026-06-19 https://github.com/openfga/openfga

GHSA-hcxc-wf8j-23hv

Authentication Bypass Red Hat Suse

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Attacker needs a valid token from the shared issuer (PR:L), reaches the API over the network (AV:N/AC:L), and gains full read/write to authorization data (C:H/I:H), with no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

6.8 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 14, 2026 - 01:45 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 14, 2026 - 01:45 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 14, 2026 - 01:37 vuln.today

cvss_changed

Severity Changed

Jul 14, 2026 - 01:37 NVD

MEDIUM HIGH

CVSS changed

Jul 14, 2026 - 01:37 NVD

6.8 (MEDIUM) 8.1 (HIGH)

Source Code Evidence Fetched

Jun 19, 2026 - 15:50 vuln.today

Analysis Generated

Jun 19, 2026 - 15:50 vuln.today

DescriptionNVD

Description

OpenFGA's OIDC authenticator skipped JWT audience (aud) validation when no audience was configured. In deployments where one identity provider issues tokens for multiple services, a token minted for an unrelated service could authenticate to OpenFGA.

Preconditions

This applies if the following preconditions are met:

You run OpenFGA with authn.method set to oidc.
You configured authn.oidc.issuer but did not set

authn.oidc.audience (--authn-oidc-audience / OPENFGA_AUTHN_OIDC_AUDIENCE).

Fix

Upgrade to OpenFGA 1.18.0 or greater. OpenFGA now refuses to start in oidc mode unless both authn.oidc.issuer and authn.oidc.audience are set, and the aud claim is always validated.

Acknowledgements

OpenFGA would like to thank https://github.com/0xVijay for the report.

AnalysisAI

Authentication bypass in OpenFGA versions 1.17.1 and earlier allows a validly-signed JWT issued for an unrelated service to authenticate to OpenFGA, because the OIDC authenticator silently skipped JWT audience (aud) validation whenever authn.oidc.audience was left unset. Any deployment using authn.method=oidc with a configured issuer but no configured audience trusts every token minted by that issuer, so an attacker holding a legitimate token for a different service behind the same identity provider gains full access to OpenFGA's authorization data. There is no public exploit identified at time of analysis and EPSS is low (0.30%, 22nd percentile), but the CVSS 8.1 rating reflects the high confidentiality and integrity impact on a system that governs fine-grained authorization decisions.

Technical ContextAI

OpenFGA is a CNCF fine-grained authorization engine (Zanzibar-inspired) written in Go (package github.com/openfga/openfga). When configured for OIDC authentication, its RemoteOidcAuthenticator validates incoming JWTs against the trusted issuer's JWKS. The root cause is CWE-287 (Improper Authentication): the code only appended the jwt.WithAudience(...) validation option when oidc.Audience was non-empty (if strings.TrimSpace(oidc.Audience) != ""), so an unset audience meant the aud claim was never checked. In a shared identity-provider topology where one IdP issues tokens for multiple downstream services, this collapses the audience-scoping guarantee that aud is designed to enforce (RFC 7519 §4.1.3), letting tokens intended for service A be replayed against OpenFGA. The fix makes audience validation unconditional and forces the server to refuse to start in oidc mode unless both issuer and audience are configured.

RemediationAI

Vendor-released patch: upgrade OpenFGA to 1.18.0 or greater (release https://github.com/openfga/openfga/releases/tag/v1.18.0, fix commit 44596773b2e62738720ef215bf7fa04352954271); Helm chart users should move to openfga-0.3.9 or later. If you cannot upgrade immediately, the direct compensating control is to explicitly set authn.oidc.audience (--authn-oidc-audience / OPENFGA_AUTHN_OIDC_AUDIENCE) to OpenFGA's expected audience value, which restores aud validation on the vulnerable code path - the trade-off is that you must ensure your identity provider actually mints tokens carrying that audience or all authentication will fail. As a secondary measure, use a dedicated issuer/IdP realm for OpenFGA so no other service's tokens are trusted, and network-restrict the OpenFGA API to reduce token-replay reach. After upgrading, note that 1.18.0 will refuse to start in oidc mode unless both issuer and audience are set, so validate your configuration before rollout. See advisory GHSA-hcxc-wf8j-23hv for details.

Same weakness CWE-287 – Improper Authentication

View all

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2020-0688 HIGH POC

8.8

CVE-2023-46805 HIGH POC

8.2

CVE-2023-35078 CRITICAL POC

9.8

CVE-2015-1187 CRITICAL POC

9.8

CVE-2024-7593 CRITICAL POC

9.8

CVE-2017-7921 CRITICAL POC

9.8

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

CVE-2023-46805 HIGH POC

8.2

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Server 16.1	Affected
SUSE Linux Enterprise Server for SAP applications 16.1	Affected
SUSE Linux Enterprise Module for Package Hub 15 SP5	Affected
SUSE Linux Enterprise Module for Package Hub 15 SP6	Affected
openSUSE Leap 15.5	Affected

CVE-2026-55689 vulnerability details – vuln.today

Back

OpenFGA CVE-2026-55689

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

Description

Preconditions

Fix

Acknowledgements

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-287 – Improper Authentication

Same technique Authentication Bypass

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code